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MEMORANDUM  FOR  UNDER  SECRETARY  OF  DEFENSE 

(COMPTROLLER)/CHIEF  FINANCIAL  OFFICER,  DOD 
DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 
NAVAL  INSPECTOR  GENERAL 

SUBJECT:  DFAS  Controls  over  Duplicate  Payments  in  One  Pay  Were  Generally  Effective,  But 
There  Were  Opportunities  for  Improvement  (Report  No.  DODIG-2012-130) 

We  are  providing  this  report  for  review  and  comment.  Although  processes  for  detecting  and 
preventing  improper  duplicate  payments  in  One  Pay  were  generally  effective,  Defense  Finance 
and  Accounting  Service  processes  and  system  controls  can  be  improved.  The  lack  of  specific 
review  procedures,  One  Pay  system  edit  controls,  and  Business  Activity  Monitoring  detection 
logic  resulted  in  the  Defense  Finance  and  Accounting  Service  making  1 1  duplicate  payments 
valued  at  $162,547.  Additionally,  the  Enterprise  Standards  and  Solutions  Directorate  did  not 
provide  specific  guidance  on  improper  payment  reporting,  which  resulted  in  the  Defense  Finance 
and  Accounting  Service  not  reporting  seven  improper  payments  and  an  understatement  on  Navy 
and  DoD  improper  payment  reports  of  $682,839.  We  considered  management  comments  on  a 
draft  of  this  report  from  the  Defense  Finance  and  Accounting  Service  when  preparing  the  final 
report. 

DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly.  The  comments 
from  the  Director,  Defense  Finance  and  Accounting  Service  Cleveland,  on  Recommendations  2, 
3. a,  3.b,  and  4  were  responsive  and  no  further  comments  are  required.  The  Director’s  comments 
on  Recommendation  1  were  not  responsive.  Therefore,  we  request  additional  comments  on  that 
recommendation  by  October  15,  2012. 

Please  provide  comments  that  conform  to  the  requirements  of  DoD  Directive  7650.3.  If 
possible,  send  a  .pdf  file  containing  your  comments  to  audcleve@dodiii.mil.  Comments  provided 
to  the  final  report  must  be  marked  and  portion-marked,  as  appropriate,  in  accordance  with  DoD 
Manual  5200.01.  Copies  of  management  comments  must  contain  the  actual  signature  of  the 
authorizing  official.  We  are  unable  to  accept  the  /Signed/  symbol  in  place  of  the  actual 
signature.  If  you  arrange  to  send  classified  comments  electronically,  you  must  send  them  over 
the  SECRET  Internet  Protocol  Router  Network  (SIPRNET). 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me  at 
(703)  601-5945  (DSN  664-5945). 


Lorin  T.  Venable,  CPA 

Acting  Assistant  Inspector  General 

DoD  Payments  and  Accounting  Operations 


Report  No.  DODIG-2012-130  (Project  No.  D201 1-D000DE-2 14.000)  September  14,  2012 

Results  in  Brief:  DFAS  Controls  Over 
Duplicate  Payments  in  One  Pay  Were 
Generally  Effective,  But  There  Were 
Opportunities  for  Improvement 


What  We  Did 

The  objective  of  the  audit  was  to  determine 
whether  the  Defense  Finance  and  Accounting 
Service  (DFAS)  processes  were  effective  at 
detecting  and  preventing  improper  payments 
processed  through  the  One  Pay  system.  From 
October  1,  2009,  through  March  31,  201 1, 
DFAS  made  more  than  one  million  payments, 
valued  at  approximately  $53  billion,  through 
One  Pay.  We  focused  on  processes  for 
detecting  and  preventing  duplicate  payments. 
We  statistically  selected  a  sample  of  33 1  unique 
payment  records,  valued  at  approximately 
$9  million,  from  a  population  that  had 
characteristics  of  duplicate  payments. 

What  We  Found 

Although  DFAS  processes  for  detecting  and 
preventing  improper  duplicate  payments  in  One 
Pay  were  generally  effective,  we  observed 
opportunities  for  improvement.  DFAS  needs  to 
improve  processes  for  detecting  and  preventing 
duplicate  payments  made  through  One  Pay. 
DFAS  processes  allowed  duplicate  payments 
because: 

•  DFAS  Cleveland  Accounts  Payable 
Directorate  did  not  have  procedures  to 
review  invoices  after  technicians  input 
and  evaluate  possible  duplicates 

(one  duplicate  payment  valued  at  $585); 

•  One  Pay  edit  controls  were  not 
configured  to  detect  duplicates  unless  all 
five  critical  data  fields  matched 

(10  duplicate  payments  valued  at 
$161,962);  and 

•  Business  Activity  Monitoring,  the 
automated  detection  tool,  did  not 
identify  duplicates  when  data  in  specific 


fields  were  different,  input  was  more 
than  25  days  apart,  or  the  amount  was 
$250  or  less  (nine  duplicate  payments 
valued  at  $1 13,096). 

As  a  result,  DFAS  made  1 1  duplicate  payments 
valued  at  $  162,547.  DFAS  took  prompt  action 
to  initiate  collection  on  the  duplicate  payments 
identified. 

In  addition,  DFAS  Cleveland  Accounts  Payable 
did  not  report  seven  improper  payments,  valued 
at  $682,839,  because  DFAS  Enterprise 
Standards  and  Solutions  Directorate  did  not 
provide  specific  guidance  on  improper  payment 
reporting.  This  resulted  in  an  understatement  on 
Navy  and  DoD  improper  payment  reports. 

What  We  Recommend 

We  recommend  that  the  DFAS  develop  and 
implement  a  review  of  manually  input  invoices 
to  detect  payments  that  are  identified  as  possible 
duplicates  by  edit  checks;  revise  One  Pay  edit 
controls  to  detect  possible  duplicates  when  less 
than  five  critical  fields  match;  and  expand  logic 
for  the  automated  detection  tool.  In  addition, 
DFAS  should  issue  specific  guidance  for 
reporting  improper  payments. 

Management  Comments  and 
Our  Response 

Management  comments  were  responsive  for 
four  of  five  recommendations.  We  request  that 
the  One  Pay  Systems  Manager,  DFAS,  provide 
additional  comments  to  Recommendation  1 . 
Please  see  the  recommendations  table  on  the 
back  of  this  page. 
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Recommendations  Table 


Management 

Recommendations 
Requiring  Comment 

No  Additional  Comments 
Required 

Defense  Finance  and  Accounting 
Service,  One  Pay  Systems  Manager 

1 

Defense  Finance  and  Accounting 
Service  Cleveland,  Accounts  Payable 
Director 

2 

Defense  Finance  and  Accounting 
Service,  Program  Manager,  Business 
Activity  Monitoring 

3. a,  3.b 

Defense  Finance  and  Accounting 
Service,  Director,  Enterprise 

Solutions  and  Standards 

4 

Please  provide  comments  by  October  15,  2012. 
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Introduction 

Objective 

The  objective  of  the  audit  was  to  determine  whether  the  Defense  Finance  and  Accounting 
Service  (DFAS)  processes  were  effective  at  detecting  and  preventing  improper  payments 
processed  through  the  One  Pay  system.  See  Appendix  A  for  a  discussion  of  the  scope 
and  methodology  related  to  the  audit  objective. 

Background 

DFAS  developed  One  Pay,  a  commercial  entitlement  system,  to  process  vendor 
payments.  DFAS  sites  such  as  Cleveland,  OH;  Columbus,  OH;  Rome,  NY ;  and 
Indianapolis,  IN,  used  One  Pay  to  establish  payment  entitlements  from  invoice  batch 
files,  Wide  Area  Work  Flow  (WAWF)  invoices,  and  invoices  submitted  by  mail  or  fax. 
DFAS  designed  One  Pay  to  create  payment  entitlements  in  accordance  with  the  Prompt 
Pay  Act,  recognize  and  manage  applicable  discounts  or  deductions,  and  compute  and 
apply  interest  when  necessary.  Invoices  could  be  input  into  One  Pay  through  manual  or 
automated  processes.  DFAS  Accounts  Payable  technicians  manually  input  invoice  data 
into  One  Pay  to  process  Navy  activities  submitted  by  mail  or  fax.  One  Pay  received  and 
processed  invoices  automatically  from  WAWF  and  batch  file  invoices  from  Navy 
activities  or  vendors. 

DFAS  Accounts  Payable  personnel  at  multiple  sites  used  One  Pay  to  process  vendor 
payments,  primarily  for  goods  and  services  purchased  by  the  Department  of  the  Navy 
(Navy).  Between  October  1,  2009,  and  March  31,  201 1,  DFAS  processed  approximately 
one  million  payments  through  One  Pay,  valued  at  approximately  $53  billion.  During  the 
same  time  period  DFAS  Cleveland  reported  879  improper  payments,  valued  at 
approximately  $17.8  million.  Of  those  879  improper  payments,  156  were  duplicate 
payments,  valued  at  $4  million. 

One  Pay  was  designed  to  detect  and  prevent  possible  duplicate  payments  by  performing 
duplicate  invoice  edit  checks.  One  Pay  perfonned  a  5 -way  match  on  invoices  processed 
manually  and  from  WAWF  and  batch  files.  When  all  of  the  five  critical  fields  in  an 
invoice  matched,  One  Pay  prevented  the  invoice  from  being  processed.  The  five  critical 
fields  were: 

•  Procurement  Instrument  Identification  Number  (PIIN) 

•  Supplemental  Procurement  Instrument  Identification  Number  (SPUN) 

•  Date  of  Invoice 

•  Invoice  Gross  Amount 

•  Invoice  Number 

DFAS  Accounts  Payable  personnel  also  used  the  Business  Activity  Monitoring  (BAM) 
tool  to  detect  improper  payments  in  One  Pay.  BAM,  a  payment  validation  tool,  was 
configured  to  detect  and  prevent  duplicate,  over,  under,  and  erroneous  payments  by 
evaluating  payments  based  on  criteria  such  as  matching  PIINs,  invoice  numbers,  and 
invoice  gross  amounts.  After  BAM  identified  possible  duplicate  payments,  DFAS 
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Accounts  Payable  technicians  reviewed  the  invoices  or  contacted  the  Navy  organizations 
to  research  and  verify  whether  the  payment  is  a  duplicate. 

We  selected  our  sample  of  33 1  unique  payment  records,  valued  at  $9.2  million,  from  a 
population  that  demonstrated  characteristics  of  duplicate  payments.  See  the  appendices 
for  scope,  methodology,  and  sampling  techniques. 

Improper  Payments  Elimination  and  Recovery  Act  of  2010 

On  July  22,  2010,  the  President  signed  Public  Law  1 1 1-204,  “Improper  Payments 
Elimination  and  Recovery  Act  of  2010,”  (IPERA)  to  prevent  the  loss  of  billions  in 
taxpayer  dollars  related  to  improper  payments.  IPERA  defines  improper  payments  as  any 
payment  that  should  not  have  been  made  or  that  was  made  in  an  incorrect  amount 
(including  overpayments  and  underpayments)  under  statutory,  contractual, 
administrative,  or  other  legally  applicable  requirements.”  This  includes  payment  for  an 
ineligible  good  or  service,  duplicate  payments,  payment  for  a  good  or  service  not 
received,  and  payment  that  does  not  account  for  credit  for  applicable  discounts. 

DoD  Financial  Management  Regulation 

DoD  Regulation  7000. 14-R,  “DoD  Financial  Management  Regulation  (DoD  FMR),” 
volume  4,  chapter  14,  “Improper  Payments,”  December  2008,  defines  the  term 
“erroneous  payment”  as  an  improper  payment.  The  DoD  FMR  requires  DoD 
Components  to  categorize  and  report  improper  payment  data  annually.  Some  examples 
of  improper  payment  categories  are  payments  made  with  insufficient  documentation; 
errors  made  by  the  Federal  Agency  inputting,  classifying,  or  processing  applications  or 
payments;  and,  errors  due  to  inaccurate  invoices. 

Review  of  Internal  Controls 

DoD  Instruction  5010.40,  "Managers'  Internal  Control  Program  Procedures," 

July  29,  2010,  required  DoD  organizations  to  implement  a  comprehensive  system  of 
internal  controls  providing  reasonable  assurance  programs  are  operating  as  intended  and 
to  evaluate  the  effectiveness  of  the  controls.  We  identified  the  following  internal  control 
weaknesses  to  detect  and  prevent  duplicate  payments  in  One  Pay:  DFAS  Cleveland 
Accounts  Payable  Directorate  did  not  have  a  supervisory  review  process  for  manual 
invoices  identified  by  One  Pay  as  a  possible  duplicate,  allowing  a  technician  to  change 
one  of  the  five  critical  data  fields;  One  Pay’s  automated  edit  check  controls  did  not  detect 
possible  duplicate  payments  unless  all  five  critical  data  fields  matched;  and  BAM,  a  One 
Pay  automated  detection  tool,  did  not  identify  possible  duplicate  payments  when  data  in 
specific  fields  were  different,  invoices  were  entered  more  than  25  days  apart,  or  the 
invoice  amount  was  $250  or  less.  Additionally,  DFAS  Enterprise  Solutions  and 
Standards  Directorate  did  not  provide  clear  guidance  for  reporting  improper  payments. 
We  will  provide  a  copy  of  the  report  to  the  senior  official  responsible  for  internal  controls 
in  DFAS. 
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Finding.  DFAS  Controls  Over  Duplicate 
Payments  in  One  Pay  Were  Generally 
Effective,  But  There  Were  Opportunities  for 
Improvement 

DFAS  processes  for  detecting  and  preventing  improper  duplicate  payments  in  One  Pay 
were  generally  effective.  However,  DFAS  processes  and  system  controls  for  detecting 
and  preventing  duplicate  payments  can  be  improved.  DFAS  manual  and  automated 
processes  allowed  duplicate  payments  because: 

•  DFAS  Cleveland  Accounts  Payable  Directorate  did  not  have  a  supervisory  review 
process  to  check  payment  records  identified  by  One  Pay  as  possible  duplicates 
and  changed  by  a  technician  (1  of  the  1 1  duplicate  payments); 

•  One  Pay’s  automated  edit  check  controls  did  not  detect  possible  duplicate 
payments  unless  all  five  critical  data  fields  matched  (10  of  the  1 1  duplicate 
payments);  and 

•  BAM,  a  One  Pay  automated  detection  tool,  did  not  identify  possible  duplicate 
payments  when  data  in  specific  fields  were  different,  invoices  were  entered  more 
than  25  days  apart,  or  the  invoice  amount  was  $250  or  less  (9  of  the  1 1  duplicate 
payments).1 

The  BAM  tool  detected  2  of  the  1 1  duplicate  payments;  however,  Navy  personnel 
incorrectly  detennined  the  payments  were  not  duplicates. 

As  a  result,  DFAS  Cleveland  and  Columbus  did  not  prevent  1 1  duplicate  payments, 
valued  at  $162,547,  from  being  processed  through  One  Pay.  DFAS  and  the  Navy 
initiated  action  to  collect  or  resolve  duplicate  payments  identified. 

Additionally,  DFAS  Cleveland  Accounts  Payable  personnel  did  not  report  seven 
improper  payments  as  required  by  DoD  FMR,  volume  4,  chapter  14.  This  occurred 
because  specific  guidance  for  reporting  selected  types  of  improper  payments  was  not 
provided  by  DFAS  Enterprise  Standards  and  Solutions.  As  a  result,  DFAS  Cleveland 
understated  the  amount  of  improper  payments  for  the  Navy  and  the  DoD  by  $682,839. 

Detecting  and  Preventing  Duplicate  Payments 

DFAS  processes  for  detecting  and  preventing  duplicate  payments  were  generally 
effective.  However,  DFAS  Cleveland  and  Columbus  Accounts  Payable  personnel 
processed  1 1  duplicate  payments,  valued  at  $162,547,  through  One  Pay  by  paying  for  the 
same  goods  and  services  more  than  once.  This  audit  focused  on  processes  and  controls 


1  BAM  is  a  separate  edit  check  run  on  One  Pay  data.  The  nine  payments  not  detected  by  BAM  also  failed 
one  of  the  other  controls.  Therefore  the  results  of  the  BAM  tests  are  not  to  be  combined  with  the  results  of 
the  other  two  One  Pay  edit  controls. 
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used  to  detect  and  prevent  duplicate  payments.  A  payment  was  considered  a  duplicate 
when  the  same  invoice  was  paid  to  different  vendors  or  the  same  vendor  was  paid 
multiple  times  for  the  same  goods  or  service.  Accounts  Payable  personnel  manually 
input  6  of  the  1 1  duplicate  payments  and  received  the  other  5  from  WAWF  or  batch  file 
automated  processes.  Additionally,  the  automated  improper  payment  detection  tool, 
BAM,  did  not  detect  and  prevent  9  of  these  same  1 1  duplicate  payments.  The  table 
provides  additional  information  on  the  input  and  BAM  process  for  the  1 1  duplicate 
payments. 


Table.  Process  Controls  Led  to  Duplicate  Payments 


Duplicate 

Payment 

Document 

Control 

Number 

Certified 

Invoice 

Amount 

One  Pay  Duplicate  Payments  Input 
Process  Type 

BAM  Process 
Controls 

Manual 

Automated 

WAWF 

Automated 

Batch 

Not 

Detected 
by  BAM 

BAM 

Detected 
and  Navy 
Reviewed 

9LK0373 

$  48,307.94 

X 

X 

9KK6161 

38,019.19 

X 

X 

0HF5VNA 

31,800.94 

X 

X 

0BFW5BG 

19,889.71 

x 

X 

0FG9FRB1 

19,854.72 

X 

X 

0IFU7CG 

1,283.10 

X 

X 

0EK0523 

1,142.79 

X 

X 

9LFHIP 

711.90 

X 

X 

0GFPPG9 

585.10 

X 

X 

9JF9YWX 

449.97 

X 

X 

OLFAAAM  & 

250.00 

0IFY7ML2 

X 

X 

251.75 

Total 

$162,547.11 

6 

2 

3 

9 

2 

1  DFAS  Columbus  Accounts  Payable  made  this  duplicate  payment,  all  other  payments  were  made  by 
DFAS  Cleveland  Accounts  Payable. 

2  The  same  invoice  was  paid  three  times  resulting  in  two  duplicate  payments. 


Manual  Invoice  Process  Controls 

DFAS  Cleveland  Accounts  Payable  technicians  processed  six  duplicate  payments  valued 
at  $54,773,  from  invoices  mailed  or  faxed  into  One  Pay.  The  One  Pay  duplicate  invoice 
check  control  identified  possible  duplicate  payments  when  all  five  critical  data  fields 
matched.  When  a  possible  duplicate  payment  is  detected  with  the  duplicate  invoice 
check,  the  technician  who  entered  the  invoice  is  prompted  to  research  the  original  invoice 
and  the  duplicate  to  determine  whether  the  second  payment  is  valid.  However,  even  with 
these  processes  in  place,  Accounts  Payable  personnel  still  manually  processed  six 
duplicate  payments. 

DFAS  Cleveland  Accounts  Payable  personnel  processed  five  of  the  six  duplicate  manual 
payments,  valued  at  $54,187,  with  different  PIINs  because  the  One  Pay  duplicate  invoice 
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check  was  configured  to  detect  and  prevent  duplicates  when  all  five  critical  data  fields 
matched.  For  example,  Accounts  Payable  personnel  received  and  processed  an  invoice 
package  for  manual  processing,  valued  at  $3 1 ,80 1 .  Four  hours  later,  Accounts  Payable 
personnel  received  the  same  invoice  package  and  processed  it  again.  The  cover  sheet 
indicated  the  invoice  submitted  earlier  contained  incorrect  information  including  the 
contract  number;  however,  the  second  invoice  package  was  not  submitted  into  the 
corrections  queue  for  One  Pay.  The  second  invoice  package  contained  the  correct 
contract  number.  Technicians  manually  processed  both  invoice  packages  as  new 
submissions  and  input  the  two  different  contract  numbers  as  PIINs.  DFAS  Cleveland 
Accounts  Payable  personnel  made  this  duplicate  payment  because  the  duplicate  invoice 
check  did  not  detect  the  second  invoice  with  a  different  PUN.  The  PUN,  a  critical  data 
field,  is  used  by  the  duplicate  invoice  check  to  detect  possible  duplicates. 

DFAS  Cleveland  Accounts  Payable  personnel  processed  one  duplicate  payment,  valued 
at  $585.10,  because  they  did  not  have  a  supervisory  review  process  to  review  manual 
invoices  identified  by  One  Pay  as  a  possible  duplicate  and  changed  by  a  technician.  In 

this  instance,  Accounts  Payable  personnel  received 
and  processed  an  invoice  package  by  fax  from  Navy 
personnel  for  manual  processing,  valued  at  $585.10. 
Two  weeks  later,  Accounts  Payable  personnel  received 
the  same  invoice  package  by  mail.  The  One  Pay 
duplicate  invoice  check  identified  the  invoice  as  a 
possible  duplicate  payment  when  the  Accounts 
Payable  technician  entered  the  second  invoice.  The 
technician  changed  the  first  letter  of  the  SPUN  and 
noted  it  was  not  a  duplicate  payment.  The  PUN  and 
SPUN  fields  allowed  entry  of  a  variety  of  numbers 
used  for  processing  such  as  contract  numbers,  document  numbers,  and  delivery  orders. 
Although  One  Pay’s  duplicate  invoice  check  identified  the  second  invoice  as  a  possible 
duplicate,  DFAS  Cleveland  Accounts  Payable  personnel  did  not  have  supervisory  review 
procedures  to  prevent  a  duplicate  payment  after  a  technician  incorrectly  modified  the 
invoice  data. 

The  DFAS  One  Pay  Systems  Manager  should  expand  the  duplicate  invoice  check  criteria 
to  flag  matches  on  less  than  five  critical  data  fields  in  order  to  detect  additional  duplicate 
payments.  In  addition,  the  DFAS  Cleveland  Accounts  Payable  Director  should  develop 
and  implement  a  procedure  for  supervisors  to  review  invoices  identified  by  the  duplicate 
invoice  check  and  processed  by  a  technician  as  a  valid  payment. 

Automated  Invoice  Process  Controls 

DFAS  Cleveland  and  Columbus  Accounts  Payable  made  five  duplicate  payments,  valued 
at  $107,775,  input  from  automated  processes.  Accounts  Payable  received  invoices 
electronically  from  WAWF  and  batch  files  into  One  Pay.  Accounts  Payable  personnel 
used  the  One  Pay  duplicate  invoice  check  control  to  detect  and  prevent  possible  duplicate 
payments.  When  all  five  critical  fields  matched,  One  Pay  detected  the  possible  duplicate 
payment,  and  further  review  was  required.  However,  in  five  instances  Cleveland  and 


Although  One  Pay ’s 
duplicate  invoice  check 
identified  the  second  invoice 
as  a  possible  duplicate, 
Cleveland  Accounts  Payable 
personnel  did  not  have 
supervisory  review 
procedures  to  prevent  a 
duplicate  payment... 
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Columbus  Accounts  Payable  made  duplicate  payments:  two  from  WAWF  and  three  from 
batch  files. 

The  two  duplicate  payments  input  from  WAWF  files,  and  valued  at  $20,305,  occurred 
because  the  One  Pay  duplicate  invoice  check  control  was  configured  to  detect  possible 
duplicate  payments  only  when  all  five  of  the  critical  data  fields  matched.  According  to 
Accounts  Payable  personnel,  Navy  personnel  certify  WAWF  invoices  and  electronically 
transmit  them  to  One  Pay  for  payment.  Once  received,  One  Pay  performs  a  check  of  the 
five  critical  data  fields  to  detect  and  prevent  possible  duplicate  payments.  For  example,  a 
vendor  entered,  and  a  Navy  official  certified,  the  same  invoice  with  two  different  PIINs 
in  WAWF  as  two  separate  invoices.  DFAS  received  these  two  WAWF  invoices,  valued 
at  $450,  into  One  Pay  and  paid  both.  Since  the  SPIINs  did  not  match,  the  One  Pay 
duplicate  invoice  check  did  not  detect  or  prevent  the  possible  duplicate  payment. 

The  One  Pay  duplicate  invoice  check  did  not  detect  the  three  duplicate  payments 
processed  from  batch  files,  and  valued  at  $87,470,  because  it  was  configured  to  detect 

possible  duplicate  payments  only  when  all  five 
critical  data  fields  were  the  same.  For  example,  the 
same  invoice,  valued  at  $48,308,  was  certified, 
batched,  and  transmitted  to  One  Pay  from  a  Navy 
activity  in  November  and  December  2009.  The  two 
invoices  contained  all  of  the  same  critical  data  fields, 
with  the  exception  of  the  invoice  date.  Since  the 
invoice  dates  were  different,  the  One  Pay  duplicate  invoice  check  control  did  not  detect 
and  prevent  the  duplicate  payment.  The  DFAS  One  Pay  Systems  Manager  should  change 
the  One  Pay  duplicate  invoice  check  to  detect  and  flag  upon  input,  payments  that  are 
similar,  but  have  less  than  five  matching  critical  data  fields. 

Detecting  and  Preventing  Duplicate  Payments  Using  Business 
Activity  Monitoring 

The  automated  detection  tool,  BAM,  did  not  detect  and  prevent  9  payments,  valued  at 
$1 13,096,  of  the  same  1 1  duplicate  payments  allowed  by  One  Pay.  BAM  evaluated  the 
invoice  data  daily  and  identified  possible  duplicate  payments  based  on  criteria  such  as 
matching  PIINs,  invoice  numbers,  and  gross  amounts.  Accounts  Payable  personnel  relied 
on  BAM  to  identify  possible  duplicate  payments.  Once  identified,  Accounts  Payable 
personnel  reviewed  supporting  documentation  for  manual  or  WAWF  payments  to 
detennine  whether  the  payment  was  a  duplicate.  When  BAM  identified  possible 
duplicate  payments  submitted  in  a  batch  file,  technicians  contacted  Navy  personnel  to 
verify  if  the  payment  was  a  duplicate.  Navy  personnel  responded  with  an  email  to 
confirm  the  payment  was  a  duplicate. 

BAM  did  not  detect  and  prevent  duplicate  payments  because  the  BAM  Program  Manager 
did  not  configure  logic  to  detect  duplicate  payments  when: 

•  The  PUN  or  SPUN  fields  were  different  prior  to  October  8,  2010.  On 

October  8,  2010,  DFAS  corrected  the  BAM  logic  to  detect  possible  improper 
payments  with  different  PIINs  and/or  SPIINs. 


For  example,  the  same 
invoice,  valued  at  $48,308, 
was  certified,  batched,  and 
transmitted  to  One  Pay  from 
a  Navy  activity  in  November 
and  December  2009. 
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•  Invoice  input  dates  were  more  than  25  days  apart;  and 

•  The  invoice  gross  amount  was  $250  or  less. 

BAM  logic  did  not  work  effectively  because  it  did  not  identify  nine  duplicate  payments, 
valued  at  $1 13,096,  when  PIINs  or  SPIINs  did  not  match  and  four  of  the  nine  invoices 
were  input  more  than  25  days  apart.  For  example,  Accounts  Payable  manually  input  an 
invoice  package  valued  at  $19,855.  Three  months  later,  the  same  invoice  was  input  into 
One  Pay  from  WAWF.  The  submissions  contained  different  PIINs.  BAM  did  not  detect 
this  invoice  as  a  possible  duplicate  because  the  PIINs  did  not  match  and  the  invoices 
were  entered  90  days  apart.  Even  though  the  BAM  Program  Manager  improved  the 
detection  logic  in  BAM,  the  logic  should  be  modified  to  detect  invoices  input  into  One 
Pay  more  than  25  days  apart. 

In  addition,  DFAS  made  one  duplicate  payment,  valued  at  $250,  because  the  BAM 
detection  logic  was  configured  to  only  identify  possible  duplicates  greater  than  $250. 

DFAS  Accounts  Payable  processed  the  same 
$250  invoice  three  times.  DFAS  technicians  entered  the 
invoice  three  times  using  different  variations  of  the 
contract  number  in  the  PUN  field.  This  allowed  it  to 
pass  both  the  One  Pay  duplicate  edit  check  and  BAM 
logic.  A  technician  entered  the  third  invoice  more  than 
25  days  after  the  first  two  invoices.  If  DFAS  had 
increased  the  invoice  input  date  criteria  to  more  than  25  days  apart,  this  payment  would 
have  still  occurred  because  it  was  less  than  or  equal  to  $250.  By  decreasing  the  $250 
invoice  gross  amount  threshold  in  BAM  logic,  DFAS  may  increase  the  possibility  of 
detecting  and  preventing  additional  duplicate  payments. 

Business  Activity  Monitoring  Detected,  But  Navy  Approved 
Duplicate  Payments 

BAM  detected  2  possible  duplicate  payments,  valued  at  $49,451,  of  the  1 1  duplicates 
identified.  Since  the  two  invoices  were  input  by  the  automated  batch  process  and  DFAS 
did  not  have  the  supporting  documentation,  technicians  could  not  detennine  if  the 
payments  were  duplicates.  Therefore,  the  technicians  provided  the  possible  duplicate 
payment  infonnation  to  Navy  personnel,  who  determined  whether  or  not  the  payments 
were  duplicates.  Navy  personnel  incorrectly  determined  the  invoices  submitted  for 
payment  were  not  duplicates;  and  as  a  result  duplicate  payments  were  made.  We  did  not 
perfonn  testing  of  Navy  controls  over  payments  because  Navy  processes  were  not  within 
the  scope  of  our  audit.  We  did  not  perform  work  at  the  Navy  or  make  recommendations 
for  this  issue.  However,  we  contacted  Navy  management  and  made  them  aware  of  this 
issue. 


DFAS  technicians  entered 
the  invoice  three  times 
using  different  variations  of 
the  contract  number  in  the 
PUN  field. 
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Unreported  Improper  Payments 

Cleveland  Accounts  Payable  personnel  did  not  report  1  of  the  1 1  duplicate  payments, 
valued  at  $19,890,  and  6  of  322  previously  identified  improper  payments,  valued  at 
$662,949.  According  to  DoD  FMR,  volume  4,  chapter  14,  “Improper  Payments,”  DoD 
Components  are  required  to  report  improper  payments.  DFAS  guidance  defines  an 
improper  payment  as  a  payment  that  should  not  have  been  made  or  was  made  in  the 
incorrect  amount.  In  addition,  DFAS  guidance  stated  improper  payments  should  be 
reported  whether  or  not  the  payment  resulted  in  a  bill  of  collection.  Accounts  Payable 
personnel  processed  invoices  with  incorrect  vendor  codes  or  PIINs  through  One  Pay, 
which  resulted  in  improper  payments  that  met  the  DoD  FMR  definition.  Technicians  also 
did  not  report  an  improper  payment  when  the  vendor  returned  the  improper  payment 
without  cashing  the  check.  For  example,  Cleveland  Accounts  Payable  personnel  did  not 
report  one  improper  payment,  valued  at  $257,45 1,  after  the  payment  was  processed  with 
an  incorrect  PUN.  Since  the  vendor  returned  the  check  before  collection  procedures 
started,  the  technician  did  not  report  it  as  an  improper  payment.  DFAS  guidance  does  not 
state  that  the  improper  payments  should  be  included  in  or  excluded  from  reporting.  The 
technicians  did  not  report  the  improper  payments  because  DFAS  Enterprise  Solutions  and 
Standards  Directorate  provided  payment  reporting  guidance  that  was  not  specific  and  did 
not  clearly  demonstrate  what  to  report  as  an  improper  payment. 

By  not  reporting  seven  improper  payments,  DFAS,  Navy,  and  DoD  understated  the 
amount  of  improper  payments  reported  by  $682,839.  This  did  not  provide  DFAS,  Navy, 
and  DoD  management  an  accurate  reporting  of  the  improper  payments  made  through  the 
One  Pay  system  and  did  not  meet  the  intent  of  IPERA  or  comply  with  DoD  FMR 
reporting  requirements.  DFAS  Enterprise  Solutions  and  Standards  Director  should  revise 
and  reissue  guidance  to  specifically  include  or  define  improper  payments  as  any  payment 
issued  regardless  of  whether  the  vendor  returned  the  funds. 

Management  Actions 

DFAS  Cleveland  and  Columbus  and  Navy  personnel  took  prompt  action  to  initiate 
collection  actions  on  the  four  duplicate  payments  we  identified  and  the  seven  identified 
by  DFAS.  The  BAM  Project  Manager  made  changes  to  BAM  logic  to  detect  similar 
payments,  but  with  different  PIINs  and  SPIINs. 

Additional  Testing  for  Possible  Duplicates 

We  did  not  test  all  of  the  8,808  unique  payment  records  in  the  population  that  had 
characteristics  of  a  duplicate  payment.  There  is  a  likelihood  of  more  duplicates  in  the 
population  of  payments  we  did  not  test.  The  DFAS  BAM  Program  Manager  should  use 
the  updated  logic  in  BAM  to  identify  additional  possible  duplicates  by  processing  the 
8,477  unique  payment  records  we  did  not  evaluate  through  BAM. 


2  Our  sample  contained  32  payments  already  identified  by  DFAS  as  improper  payments.  These  included 
payments  with  incorrect  vendor  codes  and  PIINs,  but  not  duplicate  payments. 
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Recommendations,  Management  Comments,  and  Our 
Response 

We  recommend  the: 

1.  Defense  Finance  and  Accounting  Service,  One  Pay  Systems  Manager,  change 
the  One  Pay  duplicate  invoice  check  to  detect  and  flag  payments  upon  input 
that  are  similar,  but  have  less  than  five  matching  critical  data  fields. 

Management  Comments 

The  Director,  DFAS  Cleveland,  responding  for  the  DFAS  One  Pay  Systems  Manager, 
disagreed.  The  Director  indicated  that  making  the  recommended  change  in  One  Pay 
would  duplicate  the  Same  Contract  and  Different  Contract  integrity  checks  that  BAM 
already  perfonns. 

Our  Response 

The  comments  provided  by  the  Director,  DFAS  Cleveland,  were  not  responsive. 

Although  we  agree  that  BAM  is  a  useful  tool  to  detect  potential  duplicate  invoices  in  One 
Pay,  BAM  does  not  meet  the  intent  of  the  recommendation.  The  preventive  control 
change  in  One  Pay  as  recommended  is  meant  to  be  a  proactive  measure,  early  in  the  One 
Pay  invoice  processing  cycle.  The  intent  is  to  prevent  potential  duplicate  invoices  from 
being  input  and  processed  in  One  Pay,  eliminating  the  duplicate  payment  before  it  is 
created  instead  of  when  it  is  queued  for  payment.  Increasing  proactive  measures  may 
result  in  efficiencies,  eliminating  duplicates  from  the  BAM  review  and  improper  payment 
collection  processes.  Additionally,  based  on  our  observations,  it  was  not  apparent  that 
BAM  consistently  identified  and  prevented  improper  duplicate  payments  prior  to 
payment.  We  request  that  the  Director,  DFAS  Cleveland  reconsider  his  position  on  the 
recommendation  and  provide  comments  on  the  final  report. 

2.  Defense  Finance  and  Accounting  Service  Cleveland,  Accounts  Payable 
Director,  improve  the  accuracy  and  reduce  the  risk  of  duplicate  payments  by 
developing  and  implementing  a  supervisory  review  of  manually  input 
invoices  identified  as  possible  duplicate  payments  by  One  Pay  and  approved 
by  a  technician  as  a  valid  payment. 

Management  Comments 

The  Director,  DFAS  Cleveland,  responding  for  the  DFAS  Cleveland  Accounts  Payable 
Director,  agreed.  The  Director,  DFAS  Cleveland,  stated  that  as  of  July  1 1,  2012, 
“duplicate  by-pass  indicator”  and  potential  duplicate  report  reviews  have  been  added  to 
daily  procedures  to  ensure  technicians  did  not  mistakenly  allow  a  duplicate  invoice  to  be 
processed  in  One  Pay. 

Our  Response 

The  Director,  DFAS  Cleveland  comments  are  responsive  and  meet  the  intent  of  the 
recommendation.  No  further  comments  are  required. 
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3.  Defense  Finance  and  Accounting  Service,  Program  Manager,  Business 
Activity  Monitoring: 

a.  revise  Business  Activity  Monitoring  logic  for  detecting  and  preventing 
duplicates  to  beyond  the  “entered  within  25  days”  and  “greater  than 
$250”  criteria. 

Management  Comments 

The  Director,  DFAS  Cleveland,  responding  for  the  BAM  Program  Manager,  agreed  in 
principle.  The  Director,  DFAS  Cleveland,  stated  the  BAM  Program  Management  Office 
will  perform  various  parameters  testing,  including  those  recommended,  to  detennine 
whether  the  recommended  logic  change  would  improve  both  improper  payment 
prevention  and  optimized  resource  use.  The  estimated  completion  date  is 
December  30,  2012. 

b.  evaluate  the  other  8,477  unique  payment  records  from  our  population 
of  payments  with  characteristics  of  a  duplicate  payment  using  the 
revised  Business  Activity  Monitoring  logic. 

Management  Comments 

The  Director,  DFAS  Cleveland,  responding  for  the  BAM  Program  Manager,  agreed  in 
principle.  The  Director,  DFAS  Cleveland,  indicated  that  it  may  not  be  possible  to  rerun 
the  recommended  records  using  BAM,  due  to  timing  issues.  However,  he  stated  the 
BAM  Program  Management  Office  will  try  to  recreate  the  recommended  data,  with  an 
estimated  completion  date  of  December  30,  2012.  The  estimated  completion  date  for 
evaluating  the  recommended  payment  records  is  February  1,  2013. 

Our  Response 

The  Director,  DFAS  Cleveland  comments  are  responsive  and  meet  the  intent  of  the 
recommendations.  No  further  comments  are  required. 

4.  Defense  Finance  and  Accounting  Service,  Director,  Enterprise  Solutions  and 
Standards,  revise  and  reissue  guidance  for  reporting  all  improper  payments, 
and  include  examples  showing  which  improper  payments  should  be  reported, 
in  accordance  with  DoD  Financial  Management  Regulation,  volume  4, 
chapter  14,  “Improper  Payments.” 

Management  Comments 

The  Director,  DFAS  Cleveland,  responding  for  the  Director,  Enterprise  Solutions  and 
Standards,  agreed,  and  indicated  that  DFAS  will  issue  additional  guidance,  including 
examples,  as  required  by  DoD  FMR,  volume  4,  chapter  14.  The  estimated  completion 
date  is  January  31,  2013. 
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Our  Response 

The  Director,  DFAS  Cleveland  comments  are  responsive  and  meet  the  intent  of  the 
recommendation.  No  further  comments  are  required. 
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Appendix  A.  Scope  and  Methodology 

We  conducted  this  performance  audit  from  April  2011  to  June  2012  in  accordance  with 
generally  accepted  government  auditing  standards.  Those  standards  require  us  to  plan 
and  perfonn  the  audit  to  obtain  sufficient,  appropriate  evidence  to  provide  a  reasonable 
basis  for  our  findings  and  conclusions  based  on  our  audit  objectives.  We  believe  the 
evidence  obtained  provided  a  reasonable  basis  for  our  findings  and  conclusions  based  on 
our  audit  objectives. 

It  took  five  months,  from  May  2011  to  September  201 1,  to  develop  a  population.  We 
worked  with  DFAS  to  resolve  multiple  data  issues.  DFAS  provided  records  for  every 
Navy  payment  processed  through  One  Pay  from  October  1,  2009  through 
March  31,2011.  Although  DFAS  provided  the  population  in  May  2011,  they  omitted  the 
invoice  date  critical  data  field  from  the  population.  We  worked  with  DFAS  to  resolve 
data  issues  including  missing  invoice  data  for  April  2010,  unconventional  PIINs,3 
interest-only  payment  records,4  and  payment  records  valued  at  $0.00. 5 

We  reviewed  DoD  and  DFAS  guidance  for  improper  payments,  and  focused  our  review 
on  possible  duplicate  payments  and  the  processes  for  detecting  and  preventing  duplicate 
payments  at  DFAS.  We  did  not  observe  the  processes  in  place  at  the  Navy  activities.  We 
considered  the  five  critical  data  fields  DFAS  used  to  identify  possible  duplicate 
payments: 

•  Procurement  Instrument  Identification  Number  (PUN) 

•  Supplemental  Procurement  Instrument  Identification  Number  (SPUN) 

•  Date  of  Invoice 

•  Invoice  Gross  Amount 

•  Invoice  Number 

We  developed  an  audit  population  from  payment  records  provided  in  May  2011.  The 
population  contained  payment  records  to  vendors  and  individuals.  In  an  effort  to  include 
records  most  likely  to  be  duplicate  payments,  we  used  the  five  critical  data  fields  to 
collect  matching  payment  records.  There  were  24,91 1  payment  records,  valued  at 
$40,745,467,  which  had  characteristics  of  a  duplicate  payment  from  October  1,  2009, 
through  March  31,  201 1.  We  grouped  the  24,91 1  payment  records  into  8,808  unique 
payment  records  by  using  risk  factors  that  included  at  least  two  payments  with  matching 
critical  data  fields. 


3  Unconventional  PIINs  are  15-position  document  identifiers  containing  partial  names  and  numbers.  For 
example,  lcomfortablecar  was  used  as  a  PUN. 

4  Interest-only  payments  and  interest  penalty  payments  will  contain  the  same  five  critical  fields  as  the 
original  payment. 

5  Payment  records  valued  at  $0.00  represent  pre -notifications.  A  pre -notification  is  a  test  payment  for 
$0.00  sent  to  the  vendor's  bank  account  as  a  method  of  verifying  and  validating  the  bank  information. 
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We  statistically  selected  a  sample  of  331  unique  payment  records,  valued  at  $9,277,676, 
from  the  8,808  unique  payment  records.  Then  we  combined  each  of  the  33 1  unique 
payment  records  with  its  possible  duplicate(s),  for  a  total  of  91 1  payment  records,  valued 
at  $22,850,626.  We  requested  supporting  documents  for  91 1  payment  records  from 
DFAS.  We  reviewed  the  documents  and  compared  them  to  the  payment  data  to 
determine  whether  duplicate  payments  occurred.  Upon  identification,  we  confirmed  the 
duplicate  payments  in  our  sample  with  DFAS.  Based  on  the  results,  we  assessed  whether 
DFAS  processes  were  effective  at  detecting  and  preventing  duplicate  payments  processed 
through  One  Pay.  See  Appendix  B  for  the  statistical  sampling  plan. 

Use  of  Computer-Processed  Data 

To  perfonn  this  audit,  we  used  data  from  One  Pay,  a  subsystem  of  the  Standard 
Accounting  and  Reporting  System.  We  evaluated  the  reliability  of  One  Pay  data  by: 

•  reviewing  existing  information  about  the  system  and  its  data; 

•  interviewing  agency  officials  knowledgeable  about  the  data;  and 

•  reviewing  related  DoD  IG  and  DFAS  Internal  Review  reports. 

In  addition,  we  perfonned  electronic  testing  of  the  data  to  identify  obvious  errors  in 
accuracy  and  completeness.  To  determine  whether  DFAS  processes  were  effective  at 
detecting  and  preventing  duplicate  payments  for  33 1  selected  unique  payment  records, 
we  compared  the  sample  data  to  invoices,  vouchers,  contracts,  and  requisition  forms.  We 
determined  no  differences  existed  between  system  data  and  the  supporting  documents. 

As  a  result,  the  data  were  sufficiently  reliable  (accurate,  competent,  and  complete)  for  the 
purposes  of  this  report. 

Use  of  Technical  Assistance 

The  DoD  IG  Quantitative  Methods  and  Analysis  Division  assisted  with  the  audit.  See 
Appendices  A  and  B  for  detailed  information  about  the  work  perfonned  by  the 
Quantitative  Methods  and  Analysis  Division. 

Prior  Coverage 

During  the  last  five  years,  the  Government  Accountability  Office  (GAO)  and  the  DoD  IG 
have  issued  five  reports  discussing  improper  payments.  Unrestricted  GAO  reports  can  be 
accessed  over  the  Internet  at  http://www.gao.gov.  Unrestricted  DoD  IG  reports  can  be 
accessed  at  http://www.dodig.mil/audit/reports. 

GAO 

GAO  Report  No.  GAO-09-442  "Improper  Payments:  Significant  Improvements  Needed 
in  DoD's  Efforts  to  Address  Improper  Payment  and  Recovery  Audit  Requirements," 

July  2009 
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DoD  IG 

Report  No.  DODIG-20 12-065  "DoD  Compliance  With  the  Requirements  of  the 
Improper  Payments  Elimination  and  Recovery  Act,"  March  2012 

Report  No.  D-201 1-050  "DoD  Needs  to  Improve  High  Dollar  Overpayment  Review  and 
Reporting,"  March  2011 

Report  No.  D-2008-096  "Identification  and  Reporting  of  Improper  Payments  by  the 
Defense  Logistics  Agency,"  May  2008 

Report  No.  D2008-043  "Identification  and  Reporting  of  Improper  Payments  -  Refunds 
from  DoD  Contractors,"  January  2008 
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Appendix  B.  Statistical  Sample 

Population.  Upon  our  request,  DFAS  provided  1 ,094, 1 8 1  Navy  payment  records 
processed  through  One  Pay.  DFAS  processed  the  payments  to  vendors  and  individuals 
from  October  1,  2009,  through  March  31,  2011.  We  identified  data  unrelated  to  our 
objectives  and  removed  5,652  pre-notification  records  and  97  interest-only  payment 
records  from  the  original  dataset.  The  revised  population  contained  1,088,432  payment 
records. 

We  considered  the  five  critical  data  fields  used  by  DFAS  to  choose  our  risk  factors  for 
testing.  The  One  Pay  duplicate  invoice  check  used  five  critical  data  fields  to  flag  possible 
duplicate  payment  records:  (1)  Document  Number,  also  known  as  the  Procurement 
Instrument  Identification  Number  (PUN);  (2)  Invoice  Number;  (3)  Supplemental 
Procurement  Instrument  Identification  Number  (SPUN);  (4)  Invoice  Date;  and  (5)  Invoice 
Gross  Amount.  When  all  five  critical  data  fields  on  the  invoice  entered  by  DFAS  into 
One  Pay,  matched  an  invoice  already  in  the  system,  One  Pay  disallowed  invoice  entry. 
The  DFAS  technician  reviewed  the  infonnation  and  verified  whether  a  duplicate  payment 
existed. 

We  chose  four  risk  factors  to  identify  a  population  of  possible  duplicate  payments.  We 
selected  the  same  critical  data  fields  as  DFAS  for  risk  factors  5  and  3a  and  additionally 
selected  risk  factors  4  and  3b,  to  determine  whether  the  controls  detected  and  prevented 
duplicate  payments.  We  then  identified  payment  records  with  the  following  risk  factors. 
Specifically: 

Risk  Factor  5:  We  matched  the  payment  records  with  the  same  critical  data  fields 
(Document  Number,  Invoice  Number,  SPUN,  Invoice  Date,  and  Invoice  Gross 
Amount).  The  population  contained  405  risk  factor  5  records. 

Risk  Factor  4:  Once  we  removed  the  405  risk  factor  5  payment  records  from  the 
population,  we  identified  201  risk  factor  4  records  by  matching  the  records  with 
the  same  Document  Number,  Invoice  Number,  Invoice  Gross  Amount,  and 
Invoice  Date. 

Risk  Factor  3a:  Once  we  removed  the  risk  factors  5  and  4  payment  records,  we 
identified  13,019  risk  factor  3a  records  by  matching  the  records  with  the  same 
Document  Number,  Invoice  Number,  and  Invoice  Gross  Amount. 

Risk  Factor  3b:  Once  we  removed  the  risk  factors  5,  4,  and  3a  payment  records, 
we  identified  1 1,598  risk  factor  3b  records  by  matching  the  records  with  same 
Invoice  Number,  Invoice  Gross  Amount,  and  Invoice  Date. 


15 


Once  we  identified  our  population  based  on  the  risk  factors,  we  compared  payment 
records  to  improper  payments  reported  by  DFAS  from  October  1,  2009,  through 
August  31,2011.  We  identified  and  removed  3 1 2  payment  records  (248  records  from 
risk  factor  5,  no  records  from  risk  factor  4,  18  records  from  risk  factor  3a,  and  46  records 
from  risk  factor  3b)  from  the  population  because  DFAS  previously  reported  them  as 
improper  payments.  Once  we  removed  these  records,  the  population  of  possible 
duplicate  payments  contained  24,91 1  payment  records.  We  grouped  the  24,91 1  payments 
by  the  number  of  risk  factors  that  matched  for  a  total  of  8,808  unique  payment  records. 
Table  1  shows  the  number  of  payments  records,  number  of  unique  payments,  and  value 
by  risk  factor. 


Table  1.  Population  Size 


Risk  Factors 

Number  of 
Payment  Records 

Number  of 

Unique  Payment 
Records 

Value 

(millions) 

5 

157 

76 

$2.9 

4 

201 

93 

1.6 

3a 

13,001  _ | 

4,400  | 

15.8 

3b 

11,552 

4,199  | 

20.4 

Total 

24,911 

8,808 

$40.7 
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Sample  Plan.  We  stratified  the  8,808  unique  payment  records  by  risk  factor  and  dollar 
value.  Using  what-if  analyses  and  professional  judgment,  we  designed  a  90  percent 
confidence  level  sampling  plan  that  yielded  a  sample  size  of  33 1  unique  payment  records. 
Using  the  random  number  generator  in  Excel  and  the  Statistical  Analysis  System,  we 
randomly  selected  (without  replacement)  transactions  within  each  stratum.  Table  2 
shows  the  sampling  selection  per  strata. 


Table  2.  Population  Size 


Risk 

Factors 

Strata 

Sample  Size 

Stratum  Population 
Size 

5 

GTE1  5,000 

29  _ 

29 

LT2  5,000 

20  _ 

47 

4 

GTE  10,000 

14 

14 

LT  10,000 

20  _ 

79 

3a 

GTE  40,000 

15  _ 

15 

GTE  10,000  to  LT  40,000 

34  _ 

66 

GTE  1,000  to  LT  10,000 

40  _ 

295 

LT  1,000 

40  _ 

4,064 

3b 

GTE  40,000 

19  H 

19 

GTE  10,000  to  LT  40,000 

30  _ | 

74 

GTE  1,000  to  LT  10,000 

30  _ | 

585 

LT  1,000 

40  _ 

3,521 

Total 

331  _ 

8,808 

1  Greater  than  or  equal  to  (GTE). 

2  Less  than  (LT). 

Results.  Through  a  review  of  the  33 1  unique  payment  records  contained  in  the  sample, 
we  identified  1 1  duplicate  payments,  valued  at  $162,547. 
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Glossary 

Business  Activity  Monitoring  (BAM):  A  pre-payment  validation  tool  that  identifies 
possible  improper  payments  before  disbursement.  BAM  focuses  on  detecting  and 
preventing  repeat,  over,  under,  and  erroneous  payments  in  One  Pay.  It  identifies 
improper  payments  as  early  in  the  DFAS  payment  process  as  possible,  to  assist  in  the 
identification  and/or  help  avoid  an  improper  payment.  BAM  evaluates  criteria  and 
identifies  possible  improper  payments  for  further  research  by  appropriate  personnel  for 
corrective  action. 

Critical  Data  Fields:  One  Pay  performs  a  duplicate  invoice  edit  check  on  the  following 
five  critical  data  fields: 

1 .  Procurement  Instrument  Identification  Number  (PUN) 

2.  Supplemental  Procurement  Instrument  Identification  Number  (SPUN) 

3.  Date  of  Invoice 

4.  Invoice  Gross  Amount 

5.  Invoice  Number 

The  One  Pay  Invoice  Processing  module  provides  efficient  ways  of  correcting  erroneous 
data  or  deleting  invoices  any  time  prior  to  disbursement.  To  help  detect  duplicate 
payments,  One  Pay  performs  an  additional  check  on  three  of  the  five  critical  fields  for 
manually  processed  invoices.  If  the  Invoice  Number,  PUN,  and  Gross  Amount  match  to 
an  invoice  previously  entered,  the  technician  verifies  the  invoice  they  are  entering  is  not  a 
duplicate  of  the  previous  entry. 

Improper  Payment:  According  to  P.L.  1 1 1-204  IPERA  of  2010,  any  payment  that 
should  not  have  been  made  or  that  was  made  in  an  incorrect  amount  (including 
overpayments  and  underpayments)  under  statutory,  contractual,  administrative,  or  other 
legally  applicable  requirements;  and  includes  any  payment  to  an  ineligible  recipient,  any 
payment  for  an  ineligible  good  or  service,  any  duplicate  payment,  any  payment  for  a 
good  or  service  not  received  (except  where  authorized  by  law),  and  any  payment  that 
does  not  account  for  credit  for  applicable  discounts.  According  to  DoD  FMR, 
volume  4,  chapter  14,  all  erroneous  payments  are  improper  payments. 

Invoice  Package:  Supporting  documents  required  to  process  payments  and  may  include 
a  contract,  receiving  report,  invoice,  and  payment  voucher  (DoD  FMR, 
volume  10,  chapter  8). 

One  Pay:  A  subsystem  of  the  Standard  Accounting  and  Reporting  System,  and  online 
commercial  entitlement  system  operating  together  with  the  Standard  Accounting  and 
Reporting  System  database  environment.  One  Pay  accepts  invoice  input  from  both 
Electronic  Data  Interchange  and  remote  site  batch  systems.  The  system  provides  invoice 
tracking,  online  inquiry,  status  reports,  and  check  issue  reporting. 
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Procurement  Instrument  Identification  Number  (PUN):  A  15-position  number 
assigned  to  contracts,  and  related  instruments.  For  example,  a  contract  document  number 
is  used  as  a  PUN.  The  PUN  is  also  one  of  the  five  critical  fields  in  One  Pay. 

Supplemental  Procurement  Instrument  Identification  Number  (SPUN):  A  5-digit 
number  used  with  the  PUN  to  identify  calls  or  orders  under  contracts  or  basic  ordering 
agreements.  The  SPUN  is  also  one  of  the  five  critical  fields  in  One  Pay. 

Wide  Area  Work  Flow  (WAWF):  Vendors  and  Navy  activities  submit  invoices 
electronically  to  WAWF.  WAWF  transactions  are  completely  electronic  and  automated. 
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Defense  Finance  and  Accounting  Service  Comments 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 


1 240  EAST  MINTH  STREET 

CLEVELAND  CMQ44-1S3 


AUG  -8  2l 


DFAS-JBK7CL 


MEMORANDUM  FOR  DIRECTOR,  OFFICE  OF  THyNSPECTD^iENE^L,  DEPARTMENT 
OF  DEFENSE  (ATTN:B  ,1 

SUBJECT:  Office  of  the  Inspector  General  Draft  Report,  "DFAS  Controls  Over  Duplicate 

Payments  in  One  Pay  Were  Generally  Effective,  But  There  Were  Opportunities  for 
Improvement,"  dated  July  9,  2012,  Project  No.  D2011-DO0ODE-021 4.000 

The  Defense  Finance  and  Accounting  Service  (DFAS)  is  providing  comments  on 
Recommendations  1 , 2,  3. a,  3,b,  and  4  of  die  subject  draft  audit  report  in  Attachment  1. 


can  be  reached  a 


al 


Thomas  J.  Murphy 
Director,  DFAS  Cleveland 


Attachment: 
As  stated 


cc: 


DFAS-HIP/IN 


www.dfas.mil 

Your  Finaacial  Partner  @  Work 
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DFAS  Comments  to  DoD  IG  Draft  Report,  “DFAS  Controls  Over  Duplicate  Payments  in 
One  Pay  Were  Generally  Effective,  But  There  "Were  Opportunities  for  Improvement,” 
Dated  July  9, 2012,  Project  No.  D201 1-D0O0DE-02 14.000. 

Recommendation  1.  We  recommend  the  Defense  Finance  and  Accounting  Service,  One  Pay 
Systems  Manager,  change  the  One  Pay  duplicate  invoice  check  to  detect  and  flag  payments  upon 
input  that  are  similar,  but  have  less  than  five  matching  critical  data  fields. 

Management  Comments.  Non-Concur.  DFAS  Information  &  Technology  (I&T)  has 
coordinated  with  the  Director  of  Accounts  Payable  and  we  jointly  agree  that  the  recommended 
change  should  not  be  developed  because  it  simply  duplicates  functionality  already  available  in 
the  Business:  Activity  Monitoring  (BAM)  system.  The  most  significant  integrity  checks  in  RAM 
for  One  Pay  duplicates  are  the  Invoice  Duplicate  Same  Contract  (IDSC)  and  the  Invoice 
Duplicate  Different  Contract  (IDDC)  integrity  checks  These  checks  have  fewer  combinations  of 
data  fields  that  must  match  in  order  to  detect  a  potential  improper  payment  than  the  f-way  match 
in  One  Pay. 

IDSC  generates  an  exception  if  two  invoices  have  the  same  contract  number,  gross  amount  and 
other  factors.  For  instance,  this  logic  will  flag  an  exception  when  two  invoices  have  the  same 
contract  number,  invoice  date,  invoice  gross  amount  and  invoice  number.  Another  selection 
criterion  within  IDSC  that  will  create  an  exception  is  when  both  invoices  have  identical  gross 
amounts,  co  ntract  numbers,  CAGE  codes,  invoice  numbers,  but  different  invoice  dales.  There 
are  nine  other  selection  criterions  within  IDSC  that  will  generate  an  exception.  The  different 
selection  criterion  allows  DFAS  to  flag  potential  erroneous  payments  in  a  variety  of  situations. 

IDDC  is  setup  to  create  an  exception  when  two  invoices  on  different  contracts  have  the  same 
gross  amount  and  share  other  similarities.  Currently  IDDC  has  3  different  indicators  that  will 
cause  an  exception  to  generate  when  all  factors  are  met.  The  first  is  when  both  invoices  have 
identical  currency  gross  amounts,  invoice  numbers,  material  acceptance  dates,  and  CAGE  Codes, 
and  the  gross  amount  is  greater  than  $250.  The  second  is  when  two  invoices  on  different 
contracts  have  tile  same  PUN,  invoice  number  and  gross  amount,  but  have  different  SPIINs.  The 
other  situation  is  when  both  invoices  have  identical  amounts,  invoice  numbers,  invoice  dates,  and 
CAGE  codes,  and  the  gross  amount  is  over  $250. 

Recommendation  2.  We  recommend  the  Defense  Finance  and  Accounting  Service  Cleveland, 
Accounts  Payable  Director,  improve  the  accuracy  and  reduce  the  risk  of  duplicate  payments  by 
developing  and  implementing  a  supervisory  review  of  manually  input  invoices  identified  as 
possible  duplicate  payments  by  One  Pay  and  approved  by  a  technician  as  a  valid  payment. 

Management  Comments.  Concur.  DFAS  Cleveland  Accounts  Payable  (A/P)  Audit  Testing 
identified  a  deficiency  in  reviewing  potential  duplicate  payment  overrides,  A/P  has  initiated  two 
reviews,  in  concert  with  this  deficiency  being  identified,  to  ensure  the  duplicate  payments  are 
reviewed,  when  they  are  presented  for  payment.  These  reviews  are  being  done  by  the 
Audit/Certification  team,  as  well  as  the  employees  that  are  performing  the  BAM  reviews. 

1  Attachment  I 


21 


DFAS  Comments  to  DoD  IG  Draft  Report,  “DFAS  Controls  Over  Duplicate  Payments  in 
One  Pay  Were  Generally  Effective,  But  There  W ere  Opportunities  for  Improvement,” 
Dated  Julv  9, 2012,  Project  No.  D2O11-DOO0DE-O214.OOO. 


We  have  added  the  "duplicate  by-pass  indicator”  to  the  audil/review/certification  team  daily 
review.  They  are  re-reviewing  what  the  technician  previously  identified  as  not  being  a 
duplicate/erroneous  payment.  We  are  doing  this  to  validate  it  is  in  fact  not  a  duplicate  and'or 
erroneous  payment. 

As  an  added  level  of  review  the  DFAS  Cleveland  Accounts  Payable  BAM  team  is  doing  a 
review  of  the  daily  IDA  1 88  -  Potential/Possible  duplicate  reports  for  further  validation/review  of 
invoices  that  may  have  been  processed.  The  report  identifies  those  invoices  that  the  technician 
has  previously  identified  as  not  duplicate.  The  criterion  that  is  used  by  BAM  is  established  by 
the  BAM  PMO,  in  concert  with  suggestions  by  AP. 

Completion  Date.  July  11,2012.  This  recommendation  is  considered  closed. 

Recommendation  3.».  We  recommend  the  Defense  Finance  and  Accounting  Service.  Program 
Manager.  Business  Activity  Monitoring;  revise  Business  Activity  Monitoring  logic  for  detecting 
and  preventing  duplicates  to  beyond  the  “entered  within  25  days”  and  “greater  than  $250” 
criteria. 

Management  Comments.  Concur  in  principal.  Each  time,  new  logic  is  introduced  or  existing 
logic  is  modified  the  BAM  Program  Management  Office  (PMO)  and  a  group  of  DFAS  Vendor 
Pay  Subject  Matter  Experts  conduct  validation  testing.  During  that  testing  numerous  parameters 
are  tested,  such  as  the  two  identified  in  this  recommendation,  to  determine  the  optimum  settings. 
Optimum  settings  produce  the  most  true  positive  exceptions,  with  the  least  false  positive 
exceptions,  so  that  resource  utilization  is  maximized. 

The  BAM  PMO  will  conduct  testing  of  various  settings  as  recommended  and  use  those  results  to 
determine  if  a  logic  change  would  affect  better  Improper  Payments  prevention  and  better 
resource  utilization. 

Estimated  Completion  Date.  December  30, 2012. 

Recommendation  3.b.  We  recommend  the  Defense  Finance  and  Accounting  Service,  Program 
Manager.  Business  Activity  Monitoring;  evaluate  the  other  8,477  unique  payment  records  from 
our  population  of  payments  with  characteristics  of  a  duplicate  payment  using  the  revised 
Business  Activity  Monitoring  logic. 


2  Attachment  1 
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DFAS  Comments  to  DoD  IG  Draft  Report,  “DFAS  Controls  Over  Duplicate  Payments  in 
One  Pay  Were  Generally  Effective,  But  There  Were  Opportunities  for  Improvement,” 
Dated  July  9, 2012,  Project  No.  D2011-D000DE-0214.0OO. 

Management  Comments.  Concur  in  principal.  Due  to  the  date  parameter  changes  specified  in 
the  recommendation  and  their  relation  to  timing  of  a  transaction,  it  may  not  be  possible  to 
systematically"  rerun  the  population  provided  by  the  audit  team  and  obtain  “timely”  results.  The 
BAM  PMO  will  attempt  to  reconstruct  the  timeframe  and  use  the  recommended  data  set,  but  this 
may  result  in  a  manual  review  of  all  8,477  transactions  to  determine  if  they  would  trigger  the 
new  parameters. 

Estimated  Completion  Date.  February  1, 2013 

BAM  PMO  efforts  to  be  completed  by  December  30,  2012. 


Recommendation  4.  We  recommend  the  Defense  Finance  and  Accounting  Service,  Director, 
Enterprise  Solutions  and  Standards,  revise  and  reissue  guidance  for  reporting  all  improper 
payments,  and  include  examples  showing  which  improper  payments  should  be  reported,  in 
accordance  with  DoD  Financial  Management  Regulation,  volume  4,  chapter  14,  “Improper 
Payments.” 

Management  Comments.  Concur.  DFAS  will  issue  additional  guidance  for  reporting  all 
Improper  payments  to  include  examples  as  required  in  DoD  Financial  Management  Regulation, 
volume  4,  chapter  14,  “Improper  Payments.” 

Estimated  Completion  Date.  January  3 1 , 2013. 


3  Attachment  1 
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